A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21831-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8788-1 advisory.

    It was discovered that ClamAV incorrectly handled certain zip archive files. A remote attacker could     possibly use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20337,     CVE-2026-20338)

    It was discovered that ClamAV incorrectly handled certain PESpin files. A remote attacker could possibly     use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20339)

    It was discovered that ClamAV incorrectly handled certain GPT files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20345)

    It was discovered that ClamAV incorrectly handled certain PDF files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20346)

    It was discovered that ClamAV incorrectly handled certain Mach-O files. A remote attacker could possibly     use this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20347)

    It was discovered that ClamAV incorrectly handled certain XAR files. A remote attacker could possibly use     this issue to cause ClamAV to crash, resulting in a denial of service. (CVE-2026-20348)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4208-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4179-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: rejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4180-1 advisory.

    - CVE-2026-20337: Improper boundary checks for content in zip archive parser (bsc#1274597).
    - CVE-2026-20338: invalid free due to bad ownership handling when merging ZIP catalogue records     (bsc#1274598).
    - CVE-2026-20339: integer overflow in the PESpin unpacker leads to undersized allocation and heap out-of-     bounds write       (bsc#1274599).
    - CVE-2026-20345: out-of-bounds read/write via indexing error when converting GPT partition names     (bsc#1274600).
    - CVE-2026-20346: integer underflow when parsing malformed PDF hex strings causes a crash (bsc#1274601).
    - CVE-2026-20347: integer overflow and undefined behavior when scanning malformed Mach-O files causes a     crash       (bsc#1274602).
    - CVE-2026-20348: improper size handling in the XAR parser allows excessive allocation and scan-limit     bypass       (bsc#1274603).
    - CVE-2026-46671: onenote_parser: Path traversal in `Parser:parse_notebook` allows reading files outside     the notebook       directory (bsc#1271922).
    - CVE-2025-8088: ejects path separators in NTFS alternate data stream names to prevent extraction outside     ClamAV's       temporary scan directory on Windows.

    Changes for clamav:

    Update to 1.5.4:

     * Fixed thread-safety issues in the clamd STATS command that could disclose      process memory or crash the daemon while scans and STATS requests run      concurrently. Also fixed partial socket-write handling used for large STATS      responses.
     * FreeBSD: Restored support for safe quarantine move and remove actions while      preserving protection against source-path replacement races.
     * Fixed an OpenSSL library-context leak in legacy hashing helpers when a      requested message digest cannot be fetched, such as when the default      provider is unavailable in a FIPS-enabled environment.
     * Upgraded the Rust crossbeam-epoch dependency to resolve the      RUSTSEC-2026-0204 advisory.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, Cisco Secure Endpoint is affected by multiple denial of service vulnerabilities.

  - A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for     content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker     could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could     allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the     affected software. (CVE-2026-20337)

  - A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when     processing content in zip files during scanning. An attacker could exploit this vulnerability by     submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the     ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on     the affected software. (CVE-2026-20338)

  - A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker     to cause a DoS condition or possibly other expanded impacts as a result ofmemory corruption on an     affected device. This vulnerability is due to improper boundary checks for content in PESpin files during     scanning, which may result in an integer overflow. An attacker could exploit this vulnerability by     submitting a crafted file that contains PESpin content to be scanned by ClamAV on an affected device. A     successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting     in a DoS condition on the affected software. (CVE-2026-20339)

  - A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition or possibly other expanded impacts as a result ofmemory corruption on an     affected device. This vulnerability is due to improper boundary checks for content in XAR files during     scanning. An attacker could exploit this vulnerability by submitting a crafted file that contains XAR     content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to     cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
    (CVE-2026-20348)

  - A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition or possibly other expanded impacts as a result ofmemory corruption on an     affected device. This vulnerability is due to improper handling of an endian conversion operation, which     may result in an out-of-bounds buffer write. An attacker could exploit this vulnerability by submitting a     crafted GPT file to be scanned by ClamAV on an affected device. A successful exploit could allow the     attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected     software. (CVE-2026-20345)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to     cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when     processing content in zip files during scanning. An attacker could exploit this vulnerability by     submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the     ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on     the affected software. (CVE-2026-20338)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
367990	openSUSE 16: clamav / clamav-devel / clamav-milter / libclamav12 / etc (openSUSE-SU-2026:21831-1)	Nessus	SuSE Local Security Checks	Local	high
350303	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : ClamAV vulnerabilities (USN-8788-1)	Nessus	Ubuntu Local Security Checks	Local	high
346804	SUSE SLES15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4208-1)	Nessus	SuSE Local Security Checks	Local	high
346209	SUSE SLES12: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4179-1)	Nessus	SuSE Local Security Checks	Local	high
346206	SUSE SLED15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4180-1)	Nessus	SuSE Local Security Checks	Local	high
335452	Cisco Secure Endpoint Multiple ClamAV DoS (cisco-sa-clamav-WuuvVd26)	Nessus	CISCO	Combined	high
334745	Linux Distros Unpatched Vulnerability : CVE-2026-20338	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-20338

high

Tenable Plugins

high

high

high

high

high

high

high